GitLab Community Edition and Enterprise Edition · Memory corruption
Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
There is no written leader briefing for this story yet. These questions come from the facts we hold.
Questions to ask IT
- Do we run GitLab Community Edition and Enterprise Edition, and which versions?
- Is any of it reachable from the internet?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 10 Dec?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-105437- 7.5 · HighExploitable over the network without any account, under specific conditions, but only if a user takes an action, such as opening a file or link. High impact on confidentiality, integrity and availability.CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Not listed
- Not linked from the CVE record
No technical write-up beyond these facts and the summary below yet.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- On 10 November 2026, we released versions 19.5.4, 19.4.6, 19.3.8 for GitLab Community Edition and Enterprise Edition. These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. And GitLab Dedicated are already running a patched version. And GitLab Dedicated customers do not need to take action.
Read the original reportGitLab security releases(opens in a new tab)
Products and services involved
- GitLab Community Edition and Enterprise Edition98% match confidence · CVE-2026-105437
Pulse
Last change 24m ago · Next recheck 11 Nov 2026, 22:32 UK time
- Story10 Nov 2026, 22:32 UK time · 24m ago
Linked reporting from GitLab security releases (vendor psirt).
Read source (GitLab security releases)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- GitLab security releasesVendor
GitLab Critical Patch Release: 19.5.4, 19.4.6, 19.3.8
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control
- ProbableSummary fact75% confidence
On 10 November 2026, we released versions 19.5.4, 19.4.6, 19.3.8 for GitLab Community Edition and Enterprise Edition. These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. And GitLab Dedicated are already running a patched version. And GitLab Dedicated customers do not need to take action.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-105437